Every environment I have audited has the same ghost.
An IAM user with an access key and a secret key. Created for a script, a cron job, a device that needed to reach AWS. It worked, so nobody touched it again.
Months pass. Sometimes years. The key never rotates. And when someone finally remembers it exists, the harder question shows up: where is it configured? On which server, in which container, in whose laptop, in which pipeline variable? Nobody knows. The person who created it left two roles ago.
That is the real problem with static credentials. Not that they get stolen in some dramatic breach. It's that they quietly outlive everyone's memory of them.
I did not want that ghost in my own house.
